2012 F-INSIGHT TALK

1. FORENSICINSIGHT SEMINAR
Anonymizing Activities
Kevin Koo
(kevinkoo001@gmail.com)

2. forensicinsight.org Page 2 / 14
개요
 Tor History
 Tor Concept
 AdvOR@Windows
 torsocks@Linux (Installation & Usage)
 Tor Pitfalls
 Privoxy
 Proxy Type
 Anonymizers & De-Anonymizers

3. forensicinsight.org Page 3 / 14
Tor (The Onion Routing) History
 History
- Roger Dingledine, Nick Mathewson and Paul Syverson, “Tor: The
Second-Generation Onion Router" at the 13th USENIX Security
Symposium (08.13.2004)
- Sponsored by the US Naval Research Laboratory
Financially supported by the Electronic Frontier Foundation
- Awarded the Free Software Foundation's 2010 Award for
Projects of Social Benefit
http://www.torproject.org
http://sourceforge.net/projects/advtor/

4. forensicinsight.org Page 4 / 14
Tor (The Onion Routing) Concept
 A network of virtual tunnels that allows people and groups to
improve their privacy on the Internet.
 Routing information for each link encrypted with the public key.
 Each router learns only the identity of the next router

5. forensicinsight.org Page 5 / 14
AdvOR@Windows (Installation & Usage)
 Default Port: 9001
 Supports Socks4, Socks5, HTTP, HTTPS
SOCKS4 VS SOCKS5 (supports Proxy Authentication)
 Specifies browse type, version,
OS, extensions
 Restricts connections only
from specific IPs or IP Ranges
 Selects
Exit node
New Identity
Banned routers
Favorite routers
IP Blacklist

6. forensicinsight.org Page 6 / 14
Default Port: 9050
# apt-get install –y torsocks
# wget http://ipip.kr
# usewithtor wget http://ipip.kr
# usewithtor wget http://ipip.kr -U "Mozilla/5.0 (Windows NT;
en-US) Gecko/20100316 firefox/3.6.2”
# usewithtor ssh id@myweb.hosting.com
# ./tgrab.sh http://ipip.kr
torsocks@Linux (Installation & Usage)

7. forensicinsight.org Page 7 / 14
 SocksiPy.zip
(http://socksipy.sourceforge.net, http://sourceforge.net/projects/socksipy)
# cp socks.py /usr/lib/python2.7/dist-package
 torwget.py
: SOCKS proxy initialization, socket object  SocksiPy class overriding)
: socks.setdefaultproxy(proxy((socks.proxy (PROXY_TYPE_SOCKS5,
TOR_SERVER, TOR_PORT)
socket.socket = socks.socksocket
: TOR_SERVER = “127.0.0.1”, TOR_PORT=9050
 http://malc0de.com/database/
 xnxxvideos.xn.funpic.org/dll.exe (2012.1.1)
# python torwget.py -c xnxxvideos.xn.funpic.org/dll.exe -r http://msn.com –z
xnxxvideos.xn.funpic.org/dll.exe Hostname: xnxxvideos.xn.funpic.org
Path: /dll.exe
Headers: {'Referrer': 'http://msn.com', 'Accept': '*/*', 'User-Agent': 'Opera/9.51 (Macintosh; Intel Mac
OS X; U; en)'}
Saving 786432 bytes to xnxxvideos. xn.funpic.org/dll.exe
Done!
torsocks@Linux (Installation & Usage)

8. forensicinsight.org Page 8 / 14
Tor Pitfalls
 Speed
 Untrusted tor user (Exit node)
 Tor block list

9. forensicinsight.org Page 9 / 14
Privoxy
 Port 8118
 Feasibility
filter banner ads, web bugs, and HTML annoyances
bypass click-tracking scripts and redirections
remove animation from GIFs
# apt-get install privoxy
# netstat –anlpt
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 127.0.0.1:8118 0.0.0.0:* LISTEN 10315/privoxy
 http://www.privoxy.org,
http://sourceforge.net/projects/ijbswa/files/
 /etc/privoxy/config
forward-socks5 / 127.0.0.1:9050 .

10. forensicinsight.org Page 10 / 14
Proxy Type
 Transparent Proxy
 Anonymous Proxy
 Highly Aanonymous Proxy
header_check.php
<?php
$get_headers = apache_request_headers();
echo $_SERVER[„REQUEST_METHOD‟] . “ “ .
$_SERVER[„REQUEST_URI‟] . “ “ .
$_SERVER[„SERVER_PROTOCOL‟] . “<br/>”;
foreach ($get_headers as $header => $value) {
echo “$header: $value <br/>n”;
}
echo “<br/><br/>Your IP address is: “ . $_SERVER[„REMOTE_ADDR‟];
?>

11. forensicinsight.org Page 11 / 14
Proxy Type: Transparent
 Transparent Proxy
http://www.proxy4free.com/

12. forensicinsight.org Page 12 / 14
Proxy Type: Anonymous
 Anonymous Proxy
http://www.youhide.com/

13. forensicinsight.org Page 13 / 14
Proxy Type: Highly Anonymous
 Highly Anonymous Proxy
http://aliveproxy.com/high-anonymity-proxy-list/

14. forensicinsight.org Page 14 / 14
Anonymizers & De-Anonymizers
 Web Anonymizer
http://www.anonymouse.org
 Cellular Internet Connections
 http://panopticlick.eff.org/
This site tests your browser to see how unique it is based on the information it
will share with sites it visits. (http://panopticlick.eff.org/browser-uniqueness.pdf)
 http://browserspy.dk/
This site shows you just how much information can be retrieved from your
browser just by visiting a page.